[tzhouam]

Copilot currently launches a cached Git-based runtime while host skills are copied separately, leaving users on stale or mismatched versions. Add managed installations that prepare signed stable/preview releases in the background and activate them for future sessions. Existing sessions, workers, and resumed runs retain their original runtime.

• Verify Ed25519 signatures, bundle/wheel hashes, compatibility, and hashed binary dependencies before activation.
• Atomically select the application, independent recovery launcher, and signing-key trust snapshot; quarantine failed releases and restore the previous snapshot before accepting task input.
• Preserve host settings and local skill edits during migration. Stable skill entrypoints load instructions from the connected release, with writable authoring workspaces kept separate.
• Add upgrade status/check/install/rollback/pin controls, coherent release packaging, publication CI, Windows updater checks, and operator documentation.
• Preserve current resume identity/rerun assertions and RFC, learning, feedback, and adaptive knowledge APIs.

Validation:

• 129 updater, release, SDK, packaging, and architecture tests passed.
• 82 runtime, CLI, resume, lifecycle, and concurrency tests passed.
• 73 installer, workflow, bootstrap, and imupdate tests passed.
• Thin MCP, RFC integration, agreement, feedback, and containment suites passed.
• Clean wheel build and installed CLI/MCP health check passed.
• Real signed local-feed upgrade, recovery reinstallation, and automatic rollback after candidate damage passed using temporary homes.
• Strict SPEC check: 100 verified pages; no stale or uncovered modules. Diff checks passed.

Production rollout requires provisioning the public signing key, GitHub signing secret, and an initial release. No production key or release is included. See release/README.md and doc/guide/auto-upgrades.md.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T10:17:09.030671Z	f2262a6	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.